Bug 2452999 (CVE-2026-5142)

Summary:	CVE-2026-5142 foreman: foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, ehelms, ggainey, jpasqual, juwatts, mhulan, nmoumoul, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-04-30

Description OSIDB Bzimport 2026-03-30 12:08:44 UTC

KeyPairsController#show bypasses taxonomy scoping, allowing authenticated users with view_keypairs permission to download private SSH keys across organizations by directly querying key pair IDs. This results in cross-tenant data exposure in multi-tenant deployments.

Requirements to exploit:

Authenticated user account
Permission view_keypairs (e.g., via Viewer role)
Ability to guess or enumerate KeyPair IDs (low complexity due to predictable IDs)

Comment 2 errata-xmlrpc 2026-07-01 17:27:28 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:34366 https://access.redhat.com/errata/RHSA-2026:34366

Comment 3 errata-xmlrpc 2026-07-01 17:27:28 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:34366 https://access.redhat.com/errata/RHSA-2026:34366

Comment 4 errata-xmlrpc 2026-07-01 17:28:41 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:34368 https://access.redhat.com/errata/RHSA-2026:34368

Comment 5 errata-xmlrpc 2026-07-01 17:29:07 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:34367 https://access.redhat.com/errata/RHSA-2026:34367